Trinity Industries, Inc. FEI Presentation May 31, 2012

Trinity’s Enterprise Risk Management (ERM) Evolution ERM Reputation Crisis OSHA EPA SEC Sarbanes/Oxley Contracts IRS Carbon Footprint Community Impact Employee Relations Business Continuity Access to Capital Maintaining Market Leadership Position Litigation Exposure Insurance Coverage Product Quality Sustainability Corporate Compliance Enterprise Risk Management (ERM) Process Intra-Relationship Diagram 2

3 ERM Documentation Framework Consolidated ERM Top Risk Chart Consolidated ERM Dashboard ERM Detail Risk Database Sustainability Scorecard Sustainability Database Corporate Compliance Scorecard Department Specific Data Repository for Legal and Regulatory Compliance Corporate Compliance Database Department Specific Data Repository for Sustainability Performance Plant Specific Data Repository for Legal and Regulatory Compliance Plant Specific Data Repository for Sustainability Performance One Process Not Three Data Above Red Line is Facilitated/ Managed by Internal Audit All risks, risk ratings, mitigation strategies, and supporting compliance and/or sustainability data are owned by the respective owners. Data Below Red Line is Facilitated/ Managed by Departments/Plants

Emerging IT Risks - Cybersecurity Trinity’s Defense - Access Control Layers “Cyber risk was cited as the second greatest systemic risk facing companies behind economic and financial risk, according to a recent KPMG Audit Committee Roundtable survey.” (ACI’s Spring 2011 Audit Committee Rountable Report, KPMG LLP 2011) Cybersecurity Lifecycle Inspection (e.g., regular assessments of cybersecurity program) Protection (e.g., installation of appropriate mechanisms to prevent attacks) Detection (e.g., appropriate monitoring tools exist to alert of attacks) Reaction and Response (e.g., procedures are in place to respond to attacks) Emerging IT Risk Areas Competitive Risk Threat of competitors gaining an advantage through the use of technology Portfolio Risk Danger that company is spending too much of its IT resources on basic operational expenses rather than transformational investments Execution Risk Failure to execute IT programs effectively, including major IT project implementations and initiatives Service & Security Risk Risk that systems are not available to support and service employees and customers and that critical data is not properly secured IT Risk Webster defines Cybersecurity as - measures taken to protect a computer or computer system against unauthorized access